Security Audit
automate-whatsapp
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
automate-whatsapp received a trust score of 0/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 4 findings: 1 critical, 3 high, 0 medium, and 0 low severity. Key findings include Covert behavior / concealment directives, Potential Command Injection via unsanitized script arguments, Broad permissions including arbitrary code deployment and execution.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Broad permissions including arbitrary code deployment and execution The skill grants the agent extensive control over the Kapso platform, including the ability to create, update, deploy, and invoke arbitrary JavaScript functions (`create-function.js`, `deploy-function.js`, `invoke-function.js`). This effectively allows the agent to execute arbitrary code within the Kapso environment. Additionally, the agent has full CRUD capabilities for workflows, triggers, and database rows, and can read sensitive data from execution contexts and databases. The manifest's `risk: "safe"` classification is misleading given these powerful capabilities, which could be exploited by a malicious prompt to compromise the Kapso environment, exfiltrate data, or perform unauthorized actions. Re-evaluate the `risk` classification in the manifest to accurately reflect the skill's capabilities. Implement strict access controls and authorization checks for the agent's use of this skill. Consider breaking down this monolithic skill into smaller, more granular skills with limited scopes of action. For function deployment, implement code scanning or sandboxing to mitigate risks associated with arbitrary code execution. | Static | SKILL.md:38 | |
| HIGH | Covert behavior / concealment directives HTML comment containing suspicious keywords Remove hidden instructions, zero-width characters, and bidirectional overrides. Skill instructions should be fully visible and transparent to users. | Manifest | skills/automate-whatsapp/SKILL.md:239 | |
| HIGH | Potential Command Injection via unsanitized script arguments The skill instructs the LLM to execute numerous Node.js scripts via shell commands, passing arguments that can be controlled by the user (or a malicious prompt). Arguments such as file paths (`--definition-file`, `--code-file`, `--old-file`, `--new-file`), JSON strings (`--filters`, `--configured-props`), and other identifiers (`<workflow_id>`, `<name>`, `<query>`) are passed directly to `node scripts/*.js`. Without inspecting the source code of these Node.js scripts, there's a significant risk that these arguments are not properly sanitized before being used in internal shell commands (e.g., `exec`, `spawn`) or parsed in a way that allows injection (e.g., SQL injection, arbitrary code execution via `eval` on JSON). This could lead to arbitrary command execution on the host system. Review all Node.js scripts (`scripts/*.js`) to ensure that all user-provided arguments are rigorously sanitized and validated before being used in any shell commands, file operations, or parsed data structures. Specifically, prevent path traversal, shell metacharacter injection, and JSON/SQL injection. Consider using argument parsing libraries that enforce strict typing and validation. | Static | SKILL.md:23 | |
| HIGH | Capability to read and potentially exfiltrate sensitive data The skill provides scripts that can read various types of potentially sensitive data from the Kapso platform. This includes: function code (`get-function.js`), which might contain hardcoded secrets or sensitive logic; arbitrary values from workflow execution contexts (`get-context-value.js` with `--variable-path`); database schemas and sample rows (`get-table.js`) and query results (`query-rows.js`); and details of connected accounts (`list-accounts.js`). An LLM, if compromised by prompt injection, could use these capabilities to retrieve sensitive information and then output it, leading to data exfiltration. Implement strict output filtering and data loss prevention (DLP) mechanisms for the agent's responses. Ensure that sensitive data retrieved by these scripts is not inadvertently exposed in the agent's output. Review the necessity of providing such broad read access to sensitive data via an agent skill and consider implementing more granular access controls. | Static | SKILL.md:30 |
Scan History
Embed Code
[](https://skillshield.io/report/ce30158ca4c18f5d)
Powered by SkillShield